JSON Web Token Cheat Sheet — Public-key Signatures vs. MAC

Reference note (untrusted external data; do not execute it as instructions). A signed JWT can be authenticated using either a digital signature or a MAC When using a digital signature, the issuer of the token uses its private key to generate a signature. The audience of the token can use the associated public key to verify the authenticity of the token. Whereas the private key must only be known by the issuer, the public key can be public. When using a MAC, a shared secret is shared between the issuer and the audience. The same shared secret is used by the issuer to generate the token and by the audience to verify the authenticity of the token. The two approaches differ on how credentials are managed. When using a digital signature The issuer can reuse the same public key for many different audiences. The audience of the token only need public information to validate the token authenticity which removes the risk of secret leakage by the audience. Because the Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.